All right, one last time with this diagram.
So let's say that you find yourself in a situation where you either can't or
don't want
to use Cisco's cloud.
Perfectly fine.
A lot of enterprise organizations have their own certificate authority or the
CA over here.
So our certificate authority is the one that really should be signing
certificates.
Cisco provides this PNP Cloud Connect, PNP Connect Cloud service in order to
allow us
to seamlessly get online or at least as seamlessly as possible given the
circumstances.
So we recognize that for labs and for just maybe smaller organizations with a
few sites,
we might just take advantage of Cisco's cloud.
But if we're a larger organization, we want to have full control over our
certificates.
We don't want to provide our root certificate to Cisco for security reasons or
otherwise,
we just want to do it all ourselves.
Perfectly fine.
So there's two aspects to this.
First of all, is the idea that we already have a certificate authority in our
enterprise
environment, which point we just follow this process over here, leveraging our
own CA.
However, what if we want to do this in our lab environment, but we don't want
to bother
our CBA or maybe we don't have one, we still don't want to use Cisco, but we
need to maybe
use our Linux box in order to fire this up.
Perfectly fine.
We can do that and that's what we're going to take a look at is how we go about
doing
this process.
So if you're going to use your own enterprise CA, perfectly fine, just insert
your own CA
into this process as we've walked through it a few times.
And as we're about to walk through it again, however, if you want to use our
Linux box,
our Ubuntu server, then we can certainly do that as well.
So let's go ahead and log on to our Ubuntu server here.
And what we need to do is we need to, I guess, make sure that we have a
certificate generated.
So going through that whole process is the exact same.
In fact, we'll just use the same root certificate as part of this process.
But we do also need networking enabled.
And remember in the CML template, we didn't actually have the Linux server tied
into the
network.
So let's go ahead and do that.
Let's get it tied in.
So here we are in CML and we need to be able to transfer our certificates
around.
In fact, it might be nice if I can log into it.
But what we're going to do, therefore, is connect this Ubuntu server into VPN
512.
And what we then want to do is probably just go ahead and stop it and reload it
.
Because what's probably going to happen here is in most situations is we want
to rely on
DHCP in order to get network connectivity.
If you don't have DHCP on this network, then it's perfectly fine.
We can go through the process of deploying an IP address just using our
standard Linux
commands.
And so yeah, that's going to require a little bit of Linux finagling, but it is
what it
is.
If we're going to be using an Ubuntu server to do more than just generating a
root certificate,
there's going to be a little more to it.
So fortunately, this fires up very quickly.
I'm still going to log in using Cisco Cisco.
And I can use IPA to find out if I do have an IP address.
Indeed, I did grab an IP address here, the dot 22 address using DHCP.
If you didn't use or you don't have DHCP or you weren't able to get an address,
what
we can do here is take a look at our net plan.
So we do an LS slash Etsy slash net plan.
And we get the name of our YAML file.
And then we can check it out by using pseudo nano.
So pseudo gives us super user permissions, nano is a text editing tool.
And I can just copy that in there.
Whoops.
And I also forgot the directory path.
So we need to specify the full path to edit it.
So Etsy slash net plan slash the YAML file hit enter.
And then in here, we are going to see ENS to that was referenced in CML.
And I've got it set to DHCP.
So I can set this to no or false.
And then I can add addresses from here.
And there's a lot of examples online about this.
You know, basically what we're going to do is say addresses.
And then this is following YAML.
So we need to say dash here, 192.168.17 dot whatever my IP address is going to
be.
And then I might want to give it a default route as well.
But this is the process that we'd follow.
I'm just going to exit out of here without anything because I'm using DHCP and
I have
an IP address.
So great.
So what I need to do is transfer my route certificate out of here.
Remember what we did before is we just copied the text and pasted it into
manager.
But now I actually need to get this onto my different devices.
I'm going to use SCP for this a secure way to transfer CA dot CRT.
Then I can now specify the IP address, but also the login.
So I'm going to log in with admin at 192.168.17.171 is my validator.
And I do need a colon here in order to make this work.
So I'm going to say yes, connect, provide the password, which is Cisco, thanks
to CML.
And there we go.
We transferred it.
So I'm just going to do this for all three devices.
Yes, Cisco, done.
And then 173.
Yes.
Oops, let's see if that worked.
Yeah, I did not.
That's fine.
We'll just do it again.
There we go.
And we have now transferred the route certificate to all three devices.
So now what we can do is come to one of these devices like the controller,
login using admin
and Cisco and type in V shell.
This is going to give me access to Linux.
So when we're on Ubuntu, we see that we're on the home directory with the
dollar sign
tells us where we are.
Well, guess what?
Now I see that I'm at the home directory with the dollar sign.
So I can do an LS here.
And I do see that this is awesome.
The route certificate was indeed transferred.
Otherwise, we do see also over here that we were given, first of all, the CSR
that was
generated as well as the certificate that we installed and the master route
certificate,
which should be the same thing as this over here.
But either way, we see that we have this over here on this device of
transferred it to all
of the devices.
And so from here, we can more or less do the same concept.
I need to generate a CSR and then I need to transfer the CSR back over to my CA
.
Now in order to generate a CSR, I need to install this route certificate.
I'm going to use a command to do that, but I'm not going to be able to install
it because
I've already installed a route certificate on this device and it's already in
use.
So at least give the command here.
And I'm going to use the request command.
So request root dash cert dash chain install.
And I have to specify where exactly this CA.sir is.
Now a little something about Ubuntu and Linux is that this is indicative of the
home directory
as we mentioned.
Well, the home directory is actually slash home slash the username, which is
admin in
this case.
And then we go CA dot CRT.
Now again, I've already installed a route certificate.
So I'm not going to hit enter here because it wouldn't work.
It would have a problem with the fact that I'm trying to install a second route
certificate.
So we would repeat this process on the validator and the manager.
And at that point, we would have installed the route certificate on all three.
So at that point, we need to generate the CSR.
And the way we do that is by going back to our V managed or manager interface.
So we're going to go to the same place.
We're going to go to configuration.
We're going to come down here to certificates, go to control components, use
the ellipses,
the three dots and say generate a CSR.
That's going to create that CSR file in our Linux file system.
So once again, at this point, we'd go back to our V shell command, which would
allow us
to have access to the Linux files.
We'd ship the CSR over to the CA.
And then from there, we can sign the certificate using our CA methodology,
including a Linux
command, which will include here in the skill in case you want to do this in
the lab environment.
But either way, at this point, we've gone through this whole process in much
the same
path thing, we just aren't using Cisco.
and it's a little bit more manual as far as files being sent around.